7,023 questions
Probably not but may depend on how the permissions were setup to access the resources.
--please don't forget to upvote and Accept as answer if the reply is helpful--
Service accounts in domain administrators group
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(140.8, 79%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EC%3C/text%3E%3C/svg%3E)
CyberQi
1
Reputation point
Hello,
I have a question regarding the privileges of service accounts:
Is there any situation where service accounts needs persistent inclusion in the domain administrators group? e.g making back-ups across servers.
Windows for business | Windows Client for IT Pros | Directory services | Active Directory
Windows for business | Windows Server | Devices and deployment | Configure application groups
2 answers
Sort by: Most helpful
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Anonymous2022-03-18T23:41:14.983+00:00 -
Anonymous
2022-03-19T11:39:02.293+00:00 Just checking if there's any progress or updates?
--please don't forget to
upvoteandAccept as answerif the reply is helpful-- -
CyberQi 1 Reputation point
2022-03-19T12:34:15.41+00:00 Hello,
Thanks for the swift reply.
Do I understand you right that it depends om the underlaying architrcture? Rightly configured SA do not not need to be in DA?
The question has arisen from a statement that many advanced ransomware attacks are orchestrated through obtaining a service accounts.
-
Anonymous
2022-03-19T12:37:48.687+00:00 By backups I'll assume you meant its just a copy operation. In that case the SA should only need read access to the resource.
-
Anonymous
2022-03-20T12:51:55.877+00:00 Just checking if there's any progress or updates?
--please don't forget to
upvoteandAccept as answerif the reply is helpful--
Sign in to comment -
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 80%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETB%3C/text%3E%3C/svg%3E)
Thameur-BOURBITA 36,261 Reputation points Moderator2022-03-19T00:07:17.583+00:00 Hi,
For backup , you need to add service account in Backup operators group.
Adding a service account in Domain admins can be required to perform remote installation for a software ( antivirus, monitoring tools, ..ect) remotely .
You should reduce the number of domain admins number in order to reduce attack surface.Please don't forget to mark helpful reply as answer
-
CyberQi 1 Reputation point
2022-03-19T12:35:46.96+00:00 Hello,
Are you sure that it not possible to perform remote installation without having persistent SA in DA group?
-
Thameur-BOURBITA 36,261 Reputation points Moderator
2022-03-19T13:05:04.497+00:00 Hi,
On member servers , you can use a service account member of local administrators group without need to add it to DA grou^p. However , any remote installation on domain controllers , the service account must member of DA group or domain administrators group.
Please don't forget to mark helpful reply as answer
Sign in to comment -